ci: SHA-pin third-party actions in #325 bundle workflows (closes #331)

[robotrocketscience]

Summary

Closes #331. SHA-pin every third-party action invocation in the 6 bundle workflows added by #325. Each pinned line keeps a # <tag> trailing comment for human readability.

Pins

Action	Resolved tag	SHA
crate-ci/typos	v1.46.0	bbaefadf97b0ec5fdc942684b647f1a6ab250274
step-security/harden-runner	v2.19.0	8d3c67de8e2fe68ef647c8db1e6a09f647780f40
astral-sh/setup-uv	v5.4.2	d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86
lycheeverse/lychee-action	v2.8.0	8646ba30535128ac92d33dfc9133794bfdd9b411
peter-evans/create-issue-from-file	v5.0.1	e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd

First-party actions/* (checkout, upload-artifact, github/codeql-action/*) left as @vN per GitHub guidance.

Anchoring

Each pin resolves to the latest release within the workflow's current major (e.g. setup-uv pinned to v5.4.2 even though v8.1.0 exists). Major bumps are a separate decision and out of scope for this sweep.

Verification

• crate-ci/typos@master is gone.
• All 6 workflow YAML files parse.
• Discretion grep clean.

Closes #331.

Summary by Sourcery

CI:

• Update six bundle workflows to replace version-tagged third-party actions with SHA-pinned references annotated with their corresponding release tags.

[coderabbitai]

Warning

Rate limit exceeded

@robotrocketscience has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 44 minutes and 43 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3174e9b8-0c94-4131-b594-a89f1d2d3aa9

📥 Commits

Reviewing files that changed from the base of the PR and between cbbbcf5 and a32c6a6.

📒 Files selected for processing (6)

• .github/workflows/codeql.yml
• .github/workflows/deadcode.yml
• .github/workflows/link-check.yml
• .github/workflows/mutation.yml
• .github/workflows/typos.yml
• .github/workflows/zizmor.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/issue-331-sha-pin-bundle-workflows

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 44 minutes and 43 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Pins all third-party GitHub Actions used in the six bundle workflows introduced in #325 to specific commit SHAs (while keeping tags as comments), replacing floating version tags and master refs to improve supply-chain security and reproducibility.

File-Level Changes

Change	Details	Files
Pin step-security/harden-runner invocations to a specific v2.x commit SHA across all workflows.	Replace step-security/harden-runner@v2 with step-security/harden-runner@8d3c67d in each job that uses it. Add trailing comment indicating the pinned version tag (# v2.19.0).	.github/workflows/deadcode.yml .github/workflows/link-check.yml .github/workflows/mutation.yml .github/workflows/typos.yml .github/workflows/zizmor.yml .github/workflows/codeql.yml
Pin astral-sh/setup-uv invocations to a specific v5.x commit SHA in workflows that use uv.	Replace astral-sh/setup-uv@v5 with astral-sh/setup-uv@d4b2f3b in relevant jobs. Add trailing comment indicating the pinned version tag (# v5.4.2).	.github/workflows/deadcode.yml .github/workflows/mutation.yml .github/workflows/zizmor.yml
Pin lycheeverse/lychee-action usage in the link-check workflow to a specific v2.x commit SHA.	Replace lycheeverse/lychee-action@v2 with lycheeverse/lychee-action@8646ba3. Add trailing comment indicating the pinned version tag (# v2.8.0).	.github/workflows/link-check.yml
Pin peter-evans/create-issue-from-file usage to a specific v5.x commit SHA in link-check workflow.	Replace peter-evans/create-issue-from-file@v5 with peter-evans/create-issue-from-file@e8ef132. Add trailing comment indicating the pinned version tag (# v5.0.1).	.github/workflows/link-check.yml
Pin crate-ci/typos usage from master to a specific released v1.x commit SHA in typos workflow.	Replace crate-ci/typos@master with crate-ci/typos@bbaefad. Add trailing comment indicating the pinned version tag (# v1.46.0).	.github/workflows/typos.yml

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#331	Replace all third-party action usages in the 6 specified workflows with 40-character commit SHAs and add a trailing comment indicating the human-readable version (e.g. # v<x.y.z>), including removing crate-ci/typos@master.	✅
#331	Preserve existing versioned usage of first-party actions/* (and github/codeql-action/*) without enforcing SHA pinning.	✅

Possibly linked issues

• ci: SHA-pin third-party actions in #325 bundle workflows #331: PR implements the issue by SHA-pinning all third-party actions in the six specified workflows and removing master tag.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Since the same SHAs (e.g., step-security/harden-runner and astral-sh/setup-uv) are repeated across multiple workflows, consider centralizing them via a reusable workflow, composite action, or YAML anchors so updating pins in the future is less error-prone.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Since the same SHAs (e.g., `step-security/harden-runner` and `astral-sh/setup-uv`) are repeated across multiple workflows, consider centralizing them via a reusable workflow, composite action, or YAML anchors so updating pins in the future is less error-prone.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[robotrocketscience]

Superseded by #338. Identical pin choices across all 6 workflow files (verified via git diff of the two PR heads scoped to .github/workflows/* — only difference was an unrelated mutation.yml line that traced to base-branch drift before #333 landed). #338 was opened earlier; closing this one to consolidate. The 6 atomic commits here are functionally equivalent to #338's single squash-style commit.